{"action":"created","issue":{"url":"https://api.github.com/repos/getpelican/pelican/issues/2099","repository_url":"https://api.github.com/repos/getpelican/pelican","labels_url":"https://api.github.com/repos/getpelican/pelican/issues/2099/labels{/name}","comments_url":"https://api.github.com/repos/getpelican/pelican/issues/2099/comments","events_url":"https://api.github.com/repos/getpelican/pelican/issues/2099/events","html_url":"https://github.com/getpelican/pelican/pull/2099","id":204983702,"number":2099,"title":"Try to prevent writing outside of the output directory","user":{"login":"horazont","id":271710,"avatar_url":"https://avatars.githubusercontent.com/u/271710?v=3","gravatar_id":"","url":"https://api.github.com/users/horazont","html_url":"https://github.com/horazont","followers_url":"https://api.github.com/users/horazont/followers","following_url":"https://api.github.com/users/horazont/following{/other_user}","gists_url":"https://api.github.com/users/horazont/gists{/gist_id}","starred_url":"https://api.github.com/users/horazont/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/horazont/subscriptions","organizations_url":"https://api.github.com/users/horazont/orgs","repos_url":"https://api.github.com/users/horazont/repos","events_url":"https://api.github.com/users/horazont/events{/privacy}","received_events_url":"https://api.github.com/users/horazont/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2017-02-02T20:15:46Z","updated_at":"2017-02-27T18:42:48Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/getpelican/pelican/pulls/2099","html_url":"https://github.com/getpelican/pelican/pull/2099","diff_url":"https://github.com/getpelican/pelican/pull/2099.diff","patch_url":"https://github.com/getpelican/pelican/pull/2099.patch"},"body":"This implements two layers to prevent files from being written outside the output directory:\r\n\r\n* Firstly, a new method on ``Content`` is added which checks, called from is_valid_content, that the ``save_as`` path stays within the output directory. If this is not the case, an error is logged and the content is not generated.\r\n\r\n* Secondly, the writer checks before writing to the file that it is within the OUTPUT_PATH and raises a RuntimeError when that is not the case."},"comment":{"url":"https://api.github.com/repos/getpelican/pelican/issues/comments/282810505","html_url":"https://github.com/getpelican/pelican/pull/2099#issuecomment-282810505","issue_url":"https://api.github.com/repos/getpelican/pelican/issues/2099","id":282810505,"user":{"login":"iKevinY","id":2434728,"avatar_url":"https://avatars.githubusercontent.com/u/2434728?v=3","gravatar_id":"","url":"https://api.github.com/users/iKevinY","html_url":"https://github.com/iKevinY","followers_url":"https://api.github.com/users/iKevinY/followers","following_url":"https://api.github.com/users/iKevinY/following{/other_user}","gists_url":"https://api.github.com/users/iKevinY/gists{/gist_id}","starred_url":"https://api.github.com/users/iKevinY/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iKevinY/subscriptions","organizations_url":"https://api.github.com/users/iKevinY/orgs","repos_url":"https://api.github.com/users/iKevinY/repos","events_url":"https://api.github.com/users/iKevinY/events{/privacy}","received_events_url":"https://api.github.com/users/iKevinY/received_events","type":"User","site_admin":false},"created_at":"2017-02-27T18:42:48Z","updated_at":"2017-02-27T18:42:48Z","body":"@horazont Looks good! You'll also need to update the assertions in your tests since the error message changed."}}
{"actor":{"display_login":"iKevinY"}}